Microsoft Windows Systems Missing Manual UEFI Revocations Hit by BlackX Bootkit

Kaspersky researchers reported that a suspected China-linked state-sponsored hacking group tracked as APT41 targeted diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan in early 2026 using a new UEFI bootkit named BlackX. The malware is assessed to be an updated copycat of the BlackLotus bootkit that exploits the CVE-2022-21894 (4.4 CVSS) Secure Boot bypass vulnerability, known as Baton Drop, even on Microsoft Windows systems that have installed the security update.

Because installing the Windows patch alone does not block vulnerable binaries, attackers were able to bypass Secure Boot on systems where administrators had not manually added the "Windows Production PCA 2011" certificate—which expired on October 19, 2026—to the UEFI Forbidden List (DBX). Once deployed by an attacker with administrator privileges or physical access, BlackX installs Machine Owner Keys to load arbitrary EFI files, injects a malicious kernel driver signed with a now-revoked certificate, and deploys espionage payloads that use Google Drive, OneDrive, and Yandex.Disk for command-and-control. "On October 19, 2026, this certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted." — Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov, Kaspersky Researchers.